Mitigation
Ok, so all the google bloatware shite like Hangouts got disabled about a millisecond after I got the phone.
I'm running Lillipop
How does the worm get into the MMS message? Does it need to be deliberately planted or can it latch on to any pic in your phone?
If deliberate then as I would only open MMS messages from trusted sources I should be ok?